Okta Device Trust: Integration Setup

Learn how to set up and configure the Okta Device Trust integration in Kandji

• Overview
• Prerequisites
• Integration setup
• Configuring device platforms in Okta
  • Adding device integrations in Okta
  • Add macOS as a device integration
  • Add iOS as a device integration
• Modifying a device integration in Okta
  • Rotate a macOS challenge password or iOS Secret
  • Delete a macOS challenge password or iOS Secret
• Configuring device platforms in Kandji

Overview

Okta Device Trust allows admins to ensure that Kandji manages their Apple devices before end users can access Okta-protected apps from their devices. This, in part, enables Okta FastPass for a passwordless authentication experience for end users, enabling them to sign in to Okta and their Okta resources without needing a password. For iOS, iPadOS, and macOS devices specifically, FastPass allows users to leverage Face ID and Touch ID to access resources. Okta FastPass is a feature of Okta Identity Engine.

Prerequisites

During the integration setup process, Kandji will check for the presence of the following items. These items must be configured in the Okta tenant before setting up the ODT integration with Kandji. A warning modal will be displayed if Kandji finds one or more of these items missing.

• The Okta tenant must be migrated from Okta Classic Engine to Okta Identity Engine
• Okta FastPass must be enabled in the Okta tenant
• The Okta Verify Apple App Store app must be assigned to Kandji via Apps and Books in Apple Business Manager.
• The Okta user setting ODT should have the super admin in Okta. The super admin credentials are only needed for the initial authentication and adding if the API Service Integration.
• Okta Adaptive MFA is required in order to add Device integrations in Okta.

Integration setup

1. Login to your Kandji tenant.
2. Navigate to Integrations
3. Click Discover Integrations.
4. In the Security section, find Okta Device Trust.
5. Click Add and configure.
   
6. In the Welcome to Okta Device Trust modal, click GetStarted.
   

7. In the Specify your Okta Domain modal, enter your Okta tenant URL and click Next.

   

8. In the Sign in with Okta modal, click Sign in with Okta. This will open a new browser window and navigate you to your Okta tenant, where you will create an API Service Integration. Once that is done, you will return to Kandji to continue the ODT integration setup.
   
   

   The Okta user used to configure ODT must have the super admin role in Okta.

   

9. Once signed into Okta, you should be on the Authorize Kandji Device Trust integration page. On this page, click Install & Authorize. The Kandji API Service integration uses the following scopes:

   • okta.devices.manage

   • okta.devices.read

   • okta.authenticators.read

     

10. On the Copy your client secret modal, copy the client secret to a safe place for use later in Kandji. This is the only time you will be able to view it.

11. Click Done.

    

12. On the Kandji Device Trust overview page, copy the Client ID to a safe place for use later in Kandji.

    

13. Head back to Kandji to continue the ODT integration setup.

14. In the Complete the following tasks in Okta modal, click Next.
    

15. In the API Service Integration Credentials modal, enter the Client ID and Client Secret copied from earlier.

    

16. Click Connect to Okta. Kandji will check in the background to ensure the Okta tenant is on Okta Identity Engine and Okta FastPass is enabled.

Configuring device platforms in Okta

This section outlines creating device integration in Okta. This information is used when adding device platforms in Kandji.

Okta Adaptive MFA is required in order to add Device integrations in Okta.

Adding device integrations in Okta

1. Log in to the Okta admin portal
2. In the left-hand navigation, click Security > Device Integrations
3. Click Add platform
   

Add macOS as a device integration

1. On the Select platform step, select Desktop (Windows and macOS only).
2. Click Next.
   
3. On the Configure management attestation step, select Use Okta as certificate authority
4. For SCEP URL challenge type, select Dynamic SCEP URL and Generic.

5. Next to SCEP URL, click Generate.
   

6. Copy the SCEP URL, Challenge URL, Username, and Password to a safe place.  Later, in Kandji, this information will be used to set up MacOS as a device platform.

   • This will be the only time you can view the password. If needed, you can rotate it later in the menu from the main Device integrations page in Okta

7. Click Save.
   

Add iOS as a device integration

1. On the Select platform step, select iOS.
2. Click Next.
   
3. On the Configure management attestation step, copy the Secret key to a safe place for use later in Kandji when adding iOS as a device platform in Kandji.
   • This will be the only time you can view the secret key. If needed, you can rotate the key later in the menu from the main Device integrations page in Okta.
4. For Device management provider, enter a descriptive, user-friendly value.
5. For Enrollment link, enter your Kandji tenant’s device enrollment link. (Example: https://accuhive.kandji.io/enroll where accuhive should be your tenant subdomain.)

6. Click Save

   

Modifying a device integration in Okta

Rotate a macOS challenge password or iOS Secret

1. Go to the Device Integrations page
2. Next to the integration that you want to change, click the Actions menu
3. Click the reset option for that platform
4. Click the Reset button in the modal that appears

Delete a macOS challenge password or iOS Secret

1. Go to the Device Integrations page
2. Next to the integration that you want to change, click the Actions menu
3. Click Delete
4. Click the Delete button in the modal that appears

Configuring device platforms in Kandji

1. In the Configure device platforms modal, select the platforms to configure. You can configure macOS, iOS, or both.
2. Click Next.
   

3. If selecting macOS, enter the required information in the Add macOS as a device platform modal and click Next.

   

4. If selecting iOS, enter the required information in the Add iOS as a device platform modal and click Finish setup.

   

5. In the Okta Device Trust setup complete modal, you can choose View integration settings to see additional information about the ODT integration in Kandji or choose Go to Library item to configure the Okta Verify app for ODT deployment.

   

Up next

Deploy ODT to your Apple devices using the Okta Device Trust: Configuring the Okta Verify Library item support article.